pip can extract console_scripts and gui_scripts outside installation directory

...

GHSA-JP4C-XJXW-MGF9 vulnerabilities

Vulnerabilities for packages: py3-virtualenv, py3-cassandra-medusa, kubeflow-katib, datadog-agent, pypy-3.10, py3.14-virtualenv, py3-pip...

Malicious code in pip-rce (PyPI)

--- -= Per source details. Do not edit below this line.=-...

PT-2020-8665

Name of the Vulnerable Software and Affected Versions: pip all versions Description: An issue was discovered in pip because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the...